Crash on query with a syntax error regarding an indexed property

[mdecuir]

While trying to figure out the proper syntax for using the IN operator in a WHERE clause, I came across a pattern that consistently would cause RedisGraph to crash.

I am running on the edge build of RedisGraph.

When I have an index on a property and submit a query with a where clause of the form WHERE n.name IN 'name', the server will consistently crash with the below stack dump. When I run the same query without the index, the query encounters errors, but the server remains stable.

=== REDIS BUG REPORT START: Cut & paste starting from here ===
1:M 11 Nov 2019 16:46:41.408 # Redis 5.0.6 crashed by signal: 11
1:M 11 Nov 2019 16:46:41.408 # Crashed running the instruction at: 0x7fb45345f611
1:M 11 Nov 2019 16:46:41.408 # Accessing address: (nil)
1:M 11 Nov 2019 16:46:41.408 # Failed assertion: <no assertion failed> (<no file>:0)

------ STACK TRACE ------
redis-server: /redisgraph/src/execution_plan/optimizations/utilize_indices.c:234: _validateInExpression: Assertion `list->operand.constant.type == T_ARRAY' failed.
EIP:
/lib/x86_64-linux-gnu/libc.so.6(abort+0x1fd)[0x7fb45345f611]

Backtrace:
redis-server *:6379(logStackTrace+0x32)[0x556990d27452]
redis-server *:6379(sigsegvHandler+0x9e)[0x556990d27b2e]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7fb453610730]
/lib/x86_64-linux-gnu/libc.so.6(abort+0x1fd)[0x7fb45345f611]
/lib/x86_64-linux-gnu/libc.so.6(+0x2240f)[0x7fb45345f40f]
/lib/x86_64-linux-gnu/libc.so.6(+0x30102)[0x7fb45346d102]
/usr/lib/redis/modules/redisgraph.so(_simple_predicates+0x191)[0x7fb450bbee11]
/usr/lib/redis/modules/redisgraph.so(_applicableFilter+0x4a)[0x7fb450bbee7a]
/usr/lib/redis/modules/redisgraph.so(_applicableFilters+0x45)[0x7fb450bbef75]
/usr/lib/redis/modules/redisgraph.so(reduce_scan_op+0x55)[0x7fb450bbf1c5]
/usr/lib/redis/modules/redisgraph.so(utilizeIndices+0x5f)[0x7fb450bbf73f]
/usr/lib/redis/modules/redisgraph.so(optimizePlan+0x1f)[0x7fb450bbe5ef]
/usr/lib/redis/modules/redisgraph.so(NewExecutionPlan+0x9ce)[0x7fb450bb33de]
/usr/lib/redis/modules/redisgraph.so(Graph_Query+0x2fc)[0x7fb450bae85c]
/usr/lib/redis/modules/redisgraph.so(+0x18efad)[0x7fb450bd5fad]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x7fa3)[0x7fb453605fa3]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7fb4535364cf]

------ INFO OUTPUT ------
# Server
redis_version:5.0.6
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:24cefa6406f92a1f
redis_mode:standalone
os:Linux 5.3.0-20-generic x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:atomic-builtin
gcc_version:8.3.0
process_id:1
run_id:5f4785127453b00711ae37a780b886eb5b3b461a
tcp_port:6379
uptime_in_seconds:107
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:13209713
executable:/data/redis-server
config_file:

# Clients
connected_clients:1
client_recent_max_input_buffer:2
client_recent_max_output_buffer:0
blocked_clients:1

# Memory
used_memory:179814408
used_memory_human:171.48M
used_memory_rss:580812800
used_memory_rss_human:553.91M
used_memory_peak:179814408
used_memory_peak_human:171.48M
used_memory_peak_perc:100.02%
used_memory_overhead:841374
used_memory_startup:791384
used_memory_dataset:178973034
used_memory_dataset_perc:99.97%
allocator_allocated:180958368
allocator_active:192356352
allocator_resident:270786560
total_system_memory:33373753344
total_system_memory_human:31.08G
used_memory_lua:37888
used_memory_lua_human:37.00K
used_memory_scripts:0
used_memory_scripts_human:0B
number_of_cached_scripts:0
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
allocator_frag_ratio:1.06
allocator_frag_bytes:11397984
allocator_rss_ratio:1.41
allocator_rss_bytes:78430208
rss_overhead_ratio:2.14
rss_overhead_bytes:310026240
mem_fragmentation_ratio:3.23
mem_fragmentation_bytes:401083784
mem_not_counted_for_evict:0
mem_replication_backlog:0
mem_clients_slaves:0
mem_clients_normal:49694
mem_aof_buffer:0
mem_allocator:jemalloc-5.1.0
active_defrag_running:0
lazyfree_pending_objects:0

# Persistence
loading:0
rdb_changes_since_last_save:15
rdb_bgsave_in_progress:0
rdb_last_save_time:1573490694
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:-1
rdb_current_bgsave_time_sec:-1
rdb_last_cow_size:0
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0

# Stats
total_connections_received:21
total_commands_processed:37
instantaneous_ops_per_sec:0
total_net_input_bytes:7790695
total_net_output_bytes:3238
instantaneous_input_kbps:0.00
instantaneous_output_kbps:0.00
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
evicted_keys:0
keyspace_hits:24
keyspace_misses:1
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:0
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0

# Replication
role:master
connected_slaves:0
master_replid:531f8537024d9f0250b3f190ac5df9ec07f6d4d3
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:0
second_repl_offset:-1
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0

# CPU
used_cpu_sys:0.847512
used_cpu_user:14.920991
used_cpu_sys_children:0.000758
used_cpu_user_children:0.001406

# Commandstats
cmdstat_keys:calls=18,usec=93,usec_per_call=5.17
cmdstat_config:calls=4,usec=25,usec_per_call=6.25
cmdstat_graph.QUERY:calls=15,usec=1003,usec_per_call=66.87

# Cluster
cluster_enabled:0

# Keyspace
db0:keys=5,expires=0,avg_ttl=0

------ CLIENT LIST OUTPUT ------
id=23 addr=172.18.0.1:50930 fd=8 name= age=48 idle=0 flags=b db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=32768 obl=0 oll=0 omem=0 events=r cmd=graph.QUERY

------ REGISTERS ------
1:M 11 Nov 2019 16:46:41.409 # 
RAX:0000000000000000 RBX:0000000000000000
RCX:0000000000000000 RDX:0000000000000000
RDI:0000000000000002 RSI:00007fb44fa419c0
RBP:00007fb4535c1ee0 RSP:00007fb44fa41ae0
R8 :0000000000000000 R9 :00007fb44fa419c0
R10:0000000000000008 R11:0000000000000246
R12:00007fb4511e6b20 R13:00007fb4511e6c50
R14:00000000000000ea R15:00007fb3d1a02980
RIP:00007fb45345f611 EFL:0000000000010246
CSGSFS:002b000000000033
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41aef) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41aee) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41aed) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41aec) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41aeb) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41aea) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41ae9) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41ae8) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41ae7) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41ae6) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41ae5) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41ae4) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.409 # (00007fb44fa41ae3) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.410 # (00007fb44fa41ae2) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.410 # (00007fb44fa41ae1) -> 0000000000000000
1:M 11 Nov 2019 16:46:41.410 # (00007fb44fa41ae0) -> 0000000000000020

------ FAST MEMORY TEST ------
1:M 11 Nov 2019 16:46:41.410 # Bio thread for job type #0 terminated
1:M 11 Nov 2019 16:46:41.410 # Bio thread for job type #1 terminated
1:M 11 Nov 2019 16:46:41.410 # Bio thread for job type #2 terminated
*** Preparing to test memory region 556990e54000 (2248704 bytes)
*** Preparing to test memory region 556993073000 (135168 bytes)
*** Preparing to test memory region 7fb398e7d000 (26738688 bytes)
*** Preparing to test memory region 7fb39a7fe000 (8388608 bytes)
*** Preparing to test memory region 7fb39afff000 (8388608 bytes)
*** Preparing to test memory region 7fb39b800000 (8388608 bytes)
*** Preparing to test memory region 7fb39c000000 (2113536 bytes)
*** Preparing to test memory region 7fb3a0279000 (5767168 bytes)
*** Preparing to test memory region 7fb3a07fa000 (8388608 bytes)
*** Preparing to test memory region 7fb3a0ffb000 (8388608 bytes)
*** Preparing to test memory region 7fb3a17fc000 (8388608 bytes)
*** Preparing to test memory region 7fb3a1ffd000 (8388608 bytes)
*** Preparing to test memory region 7fb3a27fe000 (8388608 bytes)
*** Preparing to test memory region 7fb3a2fff000 (8388608 bytes)
*** Preparing to test memory region 7fb3a3800000 (8388608 bytes)
*** Preparing to test memory region 7fb3a4000000 (39854080 bytes)
*** Preparing to test memory region 7fb3a8000000 (39854080 bytes)
*** Preparing to test memory region 7fb3ac17f000 (2621440 bytes)
*** Preparing to test memory region 7fb3ac400000 (8388608 bytes)
*** Preparing to test memory region 7fb3acc00000 (4194304 bytes)
*** Preparing to test memory region 7fb3ad0fe000 (8388608 bytes)
*** Preparing to test memory region 7fb3ad8ff000 (8388608 bytes)
*** Preparing to test memory region 7fb3ae100000 (8388608 bytes)
*** Preparing to test memory region 7fb3ae900000 (11534336 bytes)
*** Preparing to test memory region 7fb3af47f000 (3670016 bytes)
*** Preparing to test memory region 7fb3af800000 (8388608 bytes)
*** Preparing to test memory region 7fb3b0000000 (39854080 bytes)
*** Preparing to test memory region 7fb3b4000000 (39854080 bytes)
*** Preparing to test memory region 7fb3b807e000 (2097152 bytes)
*** Preparing to test memory region 7fb3b827f000 (8388608 bytes)
*** Preparing to test memory region 7fb3b8a80000 (8388608 bytes)
*** Preparing to test memory region 7fb3b9280000 (9961472 bytes)
*** Preparing to test memory region 7fb3b9c80000 (18350080 bytes)
*** Preparing to test memory region 7fb3bafff000 (8388608 bytes)
*** Preparing to test memory region 7fb3bb800000 (8388608 bytes)
*** Preparing to test memory region 7fb3bc000000 (39854080 bytes)
*** Preparing to test memory region 7fb3c00ff000 (3670016 bytes)
*** Preparing to test memory region 7fb3c0480000 (8388608 bytes)
*** Preparing to test memory region 7fb3c0c80000 (9961472 bytes)
*** Preparing to test memory region 7fb3c177d000 (11534336 bytes)
*** Preparing to test memory region 7fb3c227e000 (8388608 bytes)
*** Preparing to test memory region 7fb3c2a7f000 (8388608 bytes)
*** Preparing to test memory region 7fb3c3280000 (8388608 bytes)
*** Preparing to test memory region 7fb3c3a80000 (45621248 bytes)
*** Preparing to test memory region 7fb3c8000000 (39854080 bytes)
*** Preparing to test memory region 7fb3cc000000 (39854080 bytes)
*** Preparing to test memory region 7fb3d0000000 (39854080 bytes)
*** Preparing to test memory region 7fb3d4000000 (6291456 bytes)
*** Preparing to test memory region 7fb3d46fd000 (3670016 bytes)
*** Preparing to test memory region 7fb3d4a7e000 (8388608 bytes)
*** Preparing to test memory region 7fb3d527f000 (8388608 bytes)
*** Preparing to test memory region 7fb3d5a80000 (8388608 bytes)
*** Preparing to test memory region 7fb3d6280000 (9961472 bytes)
*** Preparing to test memory region 7fb3d6c80000 (7864320 bytes)
*** Preparing to test memory region 7fb3d747f000 (3670016 bytes)
*** Preparing to test memory region 7fb3d7800000 (8388608 bytes)
*** Preparing to test memory region 7fb3d8000000 (2113536 bytes)
*** Preparing to test memory region 7fb3dc000000 (13250560 bytes)
*** Preparing to test memory region 7fb3e0000000 (135168 bytes)
*** Preparing to test memory region 7fb3e4000000 (135168 bytes)
*** Preparing to test memory region 7fb3e8000000 (135168 bytes)
*** Preparing to test memory region 7fb3ec079000 (2097152 bytes)
*** Preparing to test memory region 7fb3ec27a000 (8388608 bytes)
*** Preparing to test memory region 7fb3eca7b000 (8388608 bytes)
*** Preparing to test memory region 7fb3ed27b000 (5767168 bytes)
*** Preparing to test memory region 7fb3ed7fc000 (8388608 bytes)
*** Preparing to test memory region 7fb3edffd000 (8388608 bytes)
*** Preparing to test memory region 7fb3ee7fe000 (8388608 bytes)
*** Preparing to test memory region 7fb3eefff000 (8388608 bytes)
*** Preparing to test memory region 7fb3ef800000 (8388608 bytes)
*** Preparing to test memory region 7fb3f0000000 (135168 bytes)
*** Preparing to test memory region 7fb3f4000000 (135168 bytes)
*** Preparing to test memory region 7fb3f8000000 (135168 bytes)
*** Preparing to test memory region 7fb3fc000000 (135168 bytes)
*** Preparing to test memory region 7fb400000000 (135168 bytes)
*** Preparing to test memory region 7fb404000000 (135168 bytes)
*** Preparing to test memory region 7fb408000000 (135168 bytes)
*** Preparing to test memory region 7fb40c000000 (135168 bytes)
*** Preparing to test memory region 7fb410000000 (135168 bytes)
*** Preparing to test memory region 7fb414000000 (135168 bytes)
*** Preparing to test memory region 7fb418000000 (135168 bytes)
*** Preparing to test memory region 7fb41c000000 (135168 bytes)
*** Preparing to test memory region 7fb420000000 (135168 bytes)
*** Preparing to test memory region 7fb424000000 (135168 bytes)
*** Preparing to test memory region 7fb428000000 (135168 bytes)
*** Preparing to test memory region 7fb42c000000 (135168 bytes)
*** Preparing to test memory region 7fb430000000 (135168 bytes)
*** Preparing to test memory region 7fb434000000 (135168 bytes)
*** Preparing to test memory region 7fb438000000 (135168 bytes)
*** Preparing to test memory region 7fb43c000000 (56623104 bytes)
*** Preparing to test memory region 7fb43f730000 (89653248 bytes)
*** Preparing to test memory region 7fb444cb1000 (8388608 bytes)
*** Preparing to test memory region 7fb4454b2000 (8388608 bytes)
*** Preparing to test memory region 7fb445cb3000 (8388608 bytes)
*** Preparing to test memory region 7fb4464b4000 (8388608 bytes)
*** Preparing to test memory region 7fb446e80000 (14155776 bytes)
*** Preparing to test memory region 7fb447cb7000 (8388608 bytes)
*** Preparing to test memory region 7fb4484b8000 (8388608 bytes)
*** Preparing to test memory region 7fb448cb9000 (8388608 bytes)
*** Preparing to test memory region 7fb4494ba000 (8388608 bytes)
*** Preparing to test memory region 7fb449cbb000 (8388608 bytes)
*** Preparing to test memory region 7fb44a4bb000 (5767168 bytes)
*** Preparing to test memory region 7fb44aa3c000 (8388608 bytes)
*** Preparing to test memory region 7fb44b23d000 (8388608 bytes)
*** Preparing to test memory region 7fb44ba3e000 (8388608 bytes)
*** Preparing to test memory region 7fb44c23f000 (8388608 bytes)
*** Preparing to test memory region 7fb44ca40000 (8388608 bytes)
*** Preparing to test memory region 7fb44d241000 (8388608 bytes)
*** Preparing to test memory region 7fb44da42000 (8388608 bytes)
*** Preparing to test memory region 7fb44e243000 (8388608 bytes)
*** Preparing to test memory region 7fb44ea44000 (8388608 bytes)
*** Preparing to test memory region 7fb44f245000 (8388608 bytes)
*** Preparing to test memory region 7fb44fa46000 (8388608 bytes)
*** Preparing to test memory region 7fb450247000 (8388608 bytes)
*** Preparing to test memory region 7fb4513fa000 (12288 bytes)
*** Preparing to test memory region 7fb4513fe000 (8388608 bytes)
*** Preparing to test memory region 7fb451bff000 (8388608 bytes)
*** Preparing to test memory region 7fb452400000 (8388608 bytes)
*** Preparing to test memory region 7fb452c00000 (8388608 bytes)
*** Preparing to test memory region 7fb453437000 (24576 bytes)
*** Preparing to test memory region 7fb4535fa000 (16384 bytes)
*** Preparing to test memory region 7fb45361b000 (16384 bytes)
*** Preparing to test memory region 7fb4537b1000 (8192 bytes)
*** Preparing to test memory region 7fb4537b4000 (4096 bytes)
*** Preparing to test memory region 7fb4537de000 (4096 bytes)
.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.

[jeffreylovitz]

@mdecuir Thanks for the report! This query should emit the same error regardless of whether the property is indexed or not, we should have a fix in shortly. We'll report back here, but the bug and its fix will be on https://github.com/RedisGraph/redisgraph.

The IN operator always expects to work on an array, so the simplest syntax looks like:
MATCH (n) WHERE n.name IN ['name1', 'name2'] RETURN n
Though more complex constructs that evaluate to arrays are also fine!

[mdecuir]

The reason I ran into this is because the documentation I could find did not indicate how to wrap the values for an IN predicate.

Incidentally, this also might be a distinct bug, but when I have an IN predicate on an indexed property, even with the correct syntax, I am getting no results back from the query. I can still do equality checks on the indexed property without issue, but I don't know if any other operators are behaving strangely

[jeffreylovitz]

@mdecuir Those were actually two distinct issues, with the latter specifically affecting string properties only. I've resolved that and fixed the error reporting in this PR: RedisGraph/RedisGraph#735

We'll have it merged soon! The enhancement that allowed for index scans to utilize IN filters is quite new, it looks like we had some kinks to iron out still. Sorry about that!

Additionally, I've opened an issue to improve our documentation in this area at RedisGraph/RedisGraph#733.

[swilly22]

@mdecuir, I've merged @jeffreylovitz fix, can you please verify? thank you.

[DvirDukhan]

@mdecuir
I'm closing this issue, I believe it is not valid.
If you think it is still valid please re-open it.